Analysis
-
max time kernel
113s -
max time network
48s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
20-05-2022 23:01
Static task
static1
Behavioral task
behavioral1
Sample
Urgent Inquiry (HEC RFQ).exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
Urgent Inquiry (HEC RFQ).exe
Resource
win10v2004-20220414-en
General
-
Target
Urgent Inquiry (HEC RFQ).exe
-
Size
656KB
-
MD5
4dcf2260b10788856a41785081a38cb0
-
SHA1
00baebd101ee9d01d934f9b1fb524a08289dfaac
-
SHA256
651b7d097b570f7c0f182fb52c3d703fbaf3b80e189d8dea1d84e5971a5ea982
-
SHA512
53186153f42319254031e51f3d98f2a002233c8989cfa5575fadd3236ce5f740b1219598d0aa02acda05254c7a46df541c1ee55ec99d098adb7485c5b691b341
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.privateemail.com - Port:
587 - Username:
[email protected] - Password:
71c7eb1f8ba
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 6 IoCs
Processes:
resource yara_rule behavioral1/memory/1660-59-0x0000000000400000-0x000000000044C000-memory.dmp family_agenttesla behavioral1/memory/1660-60-0x0000000000400000-0x000000000044C000-memory.dmp family_agenttesla behavioral1/memory/1660-61-0x0000000000400000-0x000000000044C000-memory.dmp family_agenttesla behavioral1/memory/1660-62-0x000000000044756E-mapping.dmp family_agenttesla behavioral1/memory/1660-64-0x0000000000400000-0x000000000044C000-memory.dmp family_agenttesla behavioral1/memory/1660-66-0x0000000000400000-0x000000000044C000-memory.dmp family_agenttesla -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
Urgent Inquiry (HEC RFQ).exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Urgent Inquiry (HEC RFQ).exe Key opened \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Urgent Inquiry (HEC RFQ).exe Key opened \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Urgent Inquiry (HEC RFQ).exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
Urgent Inquiry (HEC RFQ).exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows\CurrentVersion\Run\DsWhv = "C:\\Users\\Admin\\AppData\\Roaming\\DsWhv\\DsWhv.exe" Urgent Inquiry (HEC RFQ).exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Urgent Inquiry (HEC RFQ).exedescription pid process target process PID 676 set thread context of 1660 676 Urgent Inquiry (HEC RFQ).exe Urgent Inquiry (HEC RFQ).exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
Urgent Inquiry (HEC RFQ).exepid process 1660 Urgent Inquiry (HEC RFQ).exe 1660 Urgent Inquiry (HEC RFQ).exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Urgent Inquiry (HEC RFQ).exedescription pid process Token: SeDebugPrivilege 1660 Urgent Inquiry (HEC RFQ).exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
Urgent Inquiry (HEC RFQ).exedescription pid process target process PID 676 wrote to memory of 1660 676 Urgent Inquiry (HEC RFQ).exe Urgent Inquiry (HEC RFQ).exe PID 676 wrote to memory of 1660 676 Urgent Inquiry (HEC RFQ).exe Urgent Inquiry (HEC RFQ).exe PID 676 wrote to memory of 1660 676 Urgent Inquiry (HEC RFQ).exe Urgent Inquiry (HEC RFQ).exe PID 676 wrote to memory of 1660 676 Urgent Inquiry (HEC RFQ).exe Urgent Inquiry (HEC RFQ).exe PID 676 wrote to memory of 1660 676 Urgent Inquiry (HEC RFQ).exe Urgent Inquiry (HEC RFQ).exe PID 676 wrote to memory of 1660 676 Urgent Inquiry (HEC RFQ).exe Urgent Inquiry (HEC RFQ).exe PID 676 wrote to memory of 1660 676 Urgent Inquiry (HEC RFQ).exe Urgent Inquiry (HEC RFQ).exe PID 676 wrote to memory of 1660 676 Urgent Inquiry (HEC RFQ).exe Urgent Inquiry (HEC RFQ).exe PID 676 wrote to memory of 1660 676 Urgent Inquiry (HEC RFQ).exe Urgent Inquiry (HEC RFQ).exe -
outlook_office_path 1 IoCs
Processes:
Urgent Inquiry (HEC RFQ).exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Urgent Inquiry (HEC RFQ).exe -
outlook_win_path 1 IoCs
Processes:
Urgent Inquiry (HEC RFQ).exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Urgent Inquiry (HEC RFQ).exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Urgent Inquiry (HEC RFQ).exe"C:\Users\Admin\AppData\Local\Temp\Urgent Inquiry (HEC RFQ).exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Urgent Inquiry (HEC RFQ).exe"{path}"2⤵
- Accesses Microsoft Outlook profiles
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/676-54-0x0000000075EF1000-0x0000000075EF3000-memory.dmpFilesize
8KB
-
memory/676-55-0x0000000074690000-0x0000000074C3B000-memory.dmpFilesize
5.7MB
-
memory/1660-56-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/1660-57-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/1660-59-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/1660-60-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/1660-61-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/1660-62-0x000000000044756E-mapping.dmp
-
memory/1660-64-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/1660-66-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/1660-68-0x0000000074680000-0x0000000074C2B000-memory.dmpFilesize
5.7MB